On the Use of TCP Passive Measurements for Anomaly Detection: A Case Study from an Operational 3G Network